create-agent-rig 0.9.1 → 0.10.0

package/packages/cli/dist/integrations/declaration.js

@@ -0,0 +1,158 @@
+import { isPlainObject, scanForDepthAndControlChars } from '../lib/safe-text.js';
+export const DECLARATION_REL = '.rig/integrations.json';
+export const DECLARATION_SCHEMA_VERSION = 1;
+export const MAX_DECLARATION_BYTES = 64 * 1024;
+export const VERSION_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/;
+export const ROOT_KEYS = Object.freeze([
+    'schemaVersion',
+    'integrations',
+    'targets',
+]);
+export const KNOWN_ENTRY_KEYS = Object.freeze([
+    'id',
+    'required',
+    'version',
+    'harnesses',
+    'selected',
+    'targets',
+]);
+const hash = /^[0-9a-f]{64}$/;
+export function truncateForMessage(value) {
+    return value.length > 64 ? `${value.slice(0, 64)}…` : value;
+}
+const isHarness = (value) => value === 'claude-code' || value === 'codex';
+function rejectKey(entry) {
+    for (const key of Object.keys(entry)) {
+        if (!KNOWN_ENTRY_KEYS.includes(key))
+            return ['command', 'args', 'env', 'url', 'headers', 'source'].includes(key)
+                ? 'arbitrary-command-refused'
+                : 'malformed';
+    }
+    return undefined;
+}
+export function parseDeclaration(raw, registry) {
+    if (new TextEncoder().encode(raw).byteLength > MAX_DECLARATION_BYTES)
+        return { status: 'invalid', error: 'the declaration is larger than 64 KiB' };
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        return { status: 'invalid', error: 'the declaration is not valid JSON' };
+    }
+    const scan = scanForDepthAndControlChars(parsed, 6);
+    if (scan.tooDeep)
+        return {
+            status: 'invalid',
+            error: 'the declaration nests deeper than 6 levels below its root',
+        };
+    if (scan.hasControlChar)
+        return { status: 'invalid', error: 'the declaration carries a control or format character' };
+    if (!isPlainObject(parsed) ||
+        Object.keys(parsed).some((key) => !ROOT_KEYS.includes(key)) ||
+        parsed.schemaVersion !== 1 ||
+        !Array.isArray(parsed.integrations))
+        return { status: 'invalid', error: 'the declaration shape is invalid' };
+    let targets;
+    if (Object.hasOwn(parsed, 'targets')) {
+        if (!isPlainObject(parsed.targets) ||
+            Object.keys(parsed.targets).some((key) => key !== 'codex') ||
+            (Object.hasOwn(parsed.targets, 'codex') &&
+                (!isPlainObject(parsed.targets.codex) ||
+                    Object.keys(parsed.targets.codex).length !== 1 ||
+                    typeof parsed.targets.codex.fileHash !== 'string' ||
+                    !hash.test(parsed.targets.codex.fileHash))))
+            return { status: 'invalid', error: 'the declaration targets shape is invalid' };
+        if (Object.hasOwn(parsed.targets, 'codex'))
+            targets = {
+                codex: { fileHash: parsed.targets.codex.fileHash },
+            };
+    }
+    const ids = new Set(), entries = [], rejected = [], known = new Set(registry.map((item) => item.id));
+    for (const value of parsed.integrations) {
+        if (!isPlainObject(value) ||
+            typeof value.id !== 'string' ||
+            value.id === '' ||
+            ids.has(value.id))
+            return { status: 'invalid', error: 'every declared integration needs a unique string "id"' };
+        ids.add(value.id);
+        const bad = rejectKey(value);
+        if (bad !== undefined) {
+            rejected.push({ id: value.id, reason: bad });
+            continue;
+        }
+        if (!known.has(value.id)) {
+            rejected.push({ id: value.id, reason: 'not-in-matrix' });
+            continue;
+        }
+        if (value.selected !== true ||
+            (Object.hasOwn(value, 'required') && typeof value.required !== 'boolean') ||
+            (Object.hasOwn(value, 'version') &&
+                (typeof value.version !== 'string' || !VERSION_PATTERN.test(value.version)))) {
+            rejected.push({ id: value.id, reason: 'malformed' });
+            continue;
+        }
+        let harnesses;
+        if (Object.hasOwn(value, 'harnesses')) {
+            if (!Array.isArray(value.harnesses) ||
+                value.harnesses.length === 0 ||
+                new Set(value.harnesses).size !== value.harnesses.length ||
+                !value.harnesses.every(isHarness)) {
+                rejected.push({ id: value.id, reason: 'malformed' });
+                continue;
+            }
+            harnesses = value.harnesses;
+        }
+        let targets;
+        if (Object.hasOwn(value, 'targets')) {
+            if (!isPlainObject(value.targets)) {
+                rejected.push({ id: value.id, reason: 'malformed' });
+                continue;
+            }
+            targets = {};
+            let badTarget = false;
+            for (const [name, target] of Object.entries(value.targets)) {
+                if (name !== 'claude-code' ||
+                    !isPlainObject(target) ||
+                    Object.keys(target).length !== 1 ||
+                    typeof target.entryHash !== 'string' ||
+                    !hash.test(target.entryHash)) {
+                    badTarget = true;
+                    break;
+                }
+                targets[name] = { entryHash: target.entryHash };
+            }
+            if (badTarget ||
+                (harnesses !== undefined &&
+                    Object.keys(targets).some((name) => !harnesses.includes(name)))) {
+                rejected.push({
+                    id: value.id,
+                    reason: badTarget ? 'arbitrary-command-refused' : 'malformed',
+                });
+                continue;
+            }
+        }
+        entries.push({
+            id: value.id,
+            ...(typeof value.required === 'boolean' ? { required: value.required } : {}),
+            ...(value.version === undefined ? {} : { version: value.version }),
+            ...(harnesses === undefined ? {} : { harnesses }),
+            selected: true,
+            ...(targets === undefined ? {} : { targets }),
+        });
+    }
+    return { status: 'ok', entries, rejected, ...(targets === undefined ? {} : { targets }) };
+}
+export function serializeDeclaration(entries, targets) {
+    const integrations = [...entries]
+        .sort((a, b) => a.id.localeCompare(b.id))
+        .map((entry) => ({
+        id: entry.id,
+        ...(entry.required === undefined ? {} : { required: entry.required }),
+        ...(entry.version === undefined ? {} : { version: entry.version }),
+        ...(entry.harnesses === undefined ? {} : { harnesses: entry.harnesses }),
+        selected: true,
+        ...(entry.targets === undefined ? {} : { targets: entry.targets }),
+    }));
+    return `${JSON.stringify({ schemaVersion: 1, integrations, ...(targets === undefined ? {} : { targets }) }, null, 2)}\n`;
+}

package/packages/cli/dist/integrations/doctor-guards.js

@@ -0,0 +1,126 @@
+import { initFileContents } from '../commands/init.js';
+import { MANIFEST_REL, parseManifest, sha256 } from '../lib/manifest.js';
+import { readBounded } from './verify.js';
+import { runProviderProcess } from './spawn.js';
+import { agentOsUniversalDir } from '../templates.js';
+import { isDeepStrictEqual } from 'node:util';
+const MAX_BYTES = 1024 * 1024;
+const WIRING = ['.claude/settings.json', '.codex/hooks.json'];
+const failed = (reason) => ({
+    status: 'fail',
+    reason,
+});
+function text(bytes) {
+    try {
+        return new TextDecoder('utf-8', { fatal: true, ignoreBOM: true }).decode(bytes);
+    }
+    catch {
+        return null;
+    }
+}
+function includesWiring(actual, expected) {
+    if (Array.isArray(expected))
+        return (Array.isArray(actual) &&
+            expected.every((entry) => actual.some((candidate) => includesWiring(candidate, entry))));
+    if (typeof expected !== 'object' || expected === null)
+        return actual === expected;
+    if (typeof actual !== 'object' || actual === null || Array.isArray(actual))
+        return false;
+    const wanted = expected;
+    const found = actual;
+    // A hook command must keep its complete behavior (including Windows command,
+    // synchronous execution and timeout). Foreign sibling entries remain allowed.
+    if ('command' in wanted)
+        return isDeepStrictEqual(actual, expected);
+    return Object.entries(wanted).every(([key, value]) => includesWiring(found[key], value));
+}
+/**
+ * Fixed package-owned fixture runner. The payload consists only of bytes from
+ * `initFileContents`; it never loads the checked repository's hooks, settings,
+ * commands, or input. It makes an isolated root and runs the finite fixtures
+ * under a child process managed by the common safe-process boundary.
+ */
+const FIXTURE_WRAPPER = String.raw `
+const fs=require('node:fs'),os=require('node:os'),path=require('node:path'),cp=require('node:child_process'),url=require('node:url');
+void (async()=>{
+const source=process.argv[1];
+const root=fs.mkdtempSync(path.join(os.tmpdir(),'rig-guard-fixtures-'));
+const parent=path.resolve(os.tmpdir()),resolved=path.resolve(root);
+if(!resolved.startsWith(parent+path.sep)||!path.basename(resolved).startsWith('rig-guard-fixtures-'))throw new Error('unsafe fixture root');
+let code=1;
+try {
+ const home=path.join(root,'home'); fs.mkdirSync(path.join(root,'.claude','agents'),{recursive:true});
+ fs.writeFileSync(path.join(root,'.claude','agents','code-reviewer.md'),'---\nmodel: gpt-5.6-sol\n---\n');
+ const env={...process.env,HOME:home,APPDATA:home,CLAUDE_PROJECT_DIR:root};
+ const unattended=path.join(source,'.claude','scripts','unattended-flag.mjs');
+ const flag=await import(url.pathToFileURL(unattended).href); flag.writeUnattended({item:'fixture',runDir:root,allow:[]},env);
+ const run=(rel,input)=>cp.spawnSync(process.execPath,[path.join(source,...rel.split('/'))],{cwd:root,env,input:JSON.stringify(input),encoding:'utf8',timeout:5000,maxBuffer:8192}).status;
+ const pre=(tool_input)=>({hook_event_name:'PreToolUse',tool_name:tool_input.command?'Bash':'Write',tool_input});
+ const cases=[
+  ['.claude/hooks/guard-secret-file.mjs',pre({file_path:path.join(root,'.env'),content:'TOKEN=x'}),false],
+  ['.claude/hooks/guard-secret-file.mjs',pre({file_path:path.join(root,'note.txt'),content:'safe'}),true],
+  ['.claude/hooks/block-no-verify.mjs',pre({command:'git commit --no-verify'}),false],
+  ['.claude/hooks/block-no-verify.mjs',pre({command:'git status'}),true],
+  ['.claude/hooks/guard-bash.mjs',pre({command:'git push --force origin master'}),false],
+  ['.claude/hooks/guard-bash.mjs',pre({command:'git status'}),true],
+  ['.claude/hooks/guard-rulebook.mjs',{hook_event_name:'PreToolUse',tool_name:'Edit',tool_input:{file_path:path.join(root,'.claude','agents','code-reviewer.md'),new_string:'model: gpt-5.6-terra'}},false],
+  ['.claude/hooks/guard-rulebook.mjs',pre({file_path:path.join(root,'note.txt'),content:'safe'}),true],
+  ['.claude/hooks/guard-subagent-model.mjs',{hook_event_name:'PreToolUse',tool_name:'Agent',tool_input:{subagent_type:'code-reviewer',model:'haiku'}},false],
+  ['.claude/hooks/guard-subagent-model.mjs',{hook_event_name:'PreToolUse',tool_name:'Agent',tool_input:{subagent_type:'code-reviewer'}},true]
+ ];
+ for(const [rel,input,allowed] of cases){const status=run(rel,input);if(allowed ? status!==0 : status!==2){code=1;break;} code=0;}
+} finally { fs.rmSync(resolved,{recursive:true,force:true}); }
+process.exitCode=code;
+})().catch(()=>{process.exitCode=1;});
+`;
+export async function inspectGuards(options) {
+    const manifestFile = await readBounded(options.repoDir, MANIFEST_REL, MAX_BYTES);
+    const manifest = manifestFile.status === 'ok' ? parseManifest(text(manifestFile.bytes) ?? '') : null;
+    if (manifest === null)
+        return failed('hook-wiring-invalid');
+    const expected = await initFileContents(options.repoDir, manifest.project, manifest.layers);
+    for (const rel of WIRING) {
+        const observed = await readBounded(options.repoDir, rel, MAX_BYTES);
+        const wanted = expected.get(rel);
+        const actualText = observed.status === 'ok' ? text(observed.bytes) : null;
+        const expectedText = wanted === undefined ? null : wanted;
+        if (actualText === null || expectedText === null)
+            return failed('hook-wiring-invalid');
+        let actual, generated;
+        try {
+            actual = JSON.parse(actualText);
+            generated = JSON.parse(expectedText);
+        }
+        catch {
+            return failed('hook-wiring-invalid');
+        }
+        const observedSettings = actual;
+        const expectedSettings = generated;
+        if (observedSettings?.disableAllHooks === true ||
+            !includesWiring(observedSettings?.hooks, expectedSettings.hooks))
+            return failed('hook-wiring-invalid');
+    }
+    const dependencies = [...expected.keys()].filter((rel) => rel.startsWith('.claude/hooks/') ||
+        rel.startsWith('.claude/scripts/lib/') ||
+        rel === '.claude/scripts/stop-flag.mjs' ||
+        rel === '.claude/scripts/unattended-flag.mjs' ||
+        rel === '.claude/scripts/git-env.mjs');
+    for (const rel of dependencies) {
+        const observed = await readBounded(options.repoDir, rel, MAX_BYTES);
+        const wanted = expected.get(rel);
+        if (observed.status !== 'ok' ||
+            wanted === undefined ||
+            sha256(observed.bytes) !== sha256(Buffer.from(wanted)))
+            return failed('hook-integrity-invalid');
+    }
+    const batch = await (options.runner ?? runProviderProcess)({
+        executable: process.execPath,
+        args: ['-e', FIXTURE_WRAPPER, agentOsUniversalDir()],
+        repoDir: options.repoDir,
+        timeoutMs: 30_000,
+        maxOutputBytes: 8 * 1024,
+    });
+    if (batch.status !== 'ok' || batch.exitCode !== 0)
+        return failed('guard-fixture-batch-failed');
+    return { status: 'pass', reason: 'guards-verified' };
+}

package/packages/cli/dist/integrations/doctor-workflow.js

@@ -0,0 +1,25 @@
+import { initFileContents } from '../commands/init.js';
+import { MANIFEST_REL, parseManifest, sha256 } from '../lib/manifest.js';
+import { readBounded } from './verify.js';
+export async function inspectWorkflow(options) {
+    const failed = { status: 'fail', reason: 'workflow-integrity-invalid' };
+    const source = await readBounded(options.repoDir, MANIFEST_REL, 1024 * 1024);
+    if (source.status !== 'ok')
+        return failed;
+    const manifest = parseManifest(source.bytes.toString('utf8'));
+    if (manifest === null)
+        return failed;
+    if (!manifest.layers.includes('workflow'))
+        return { status: 'pass', reason: 'not-selected' };
+    const expected = await initFileContents(options.repoDir, manifest.project, manifest.layers);
+    // Package-owned mechanisms only. No tracker reads, claim rewrites, or execution
+    // of repository scripts: the frozen behavior is compared as installed bytes.
+    for (const [rel, content] of expected) {
+        if (!rel.startsWith('.claude/scripts/'))
+            continue;
+        const observed = await readBounded(options.repoDir, rel, 1024 * 1024);
+        if (observed.status !== 'ok' || sha256(observed.bytes) !== sha256(content))
+            return failed;
+    }
+    return { status: 'pass', reason: 'workflow-verified' };
+}

package/packages/cli/dist/integrations/mcp-json.js

@@ -0,0 +1,107 @@
+import { isPlainObject } from '../lib/safe-text.js';
+const whitespace = (text, from) => {
+    while (' \t\r\n'.includes(text[from] ?? '\0'))
+        from++;
+    return from;
+};
+const stringEnd = (text, from) => {
+    for (let i = from + 1; i < text.length; i++) {
+        if (text[i] === '\\')
+            i++;
+        else if (text[i] === '"')
+            return i + 1;
+    }
+    throw new Error('mcp-config-invalid');
+};
+// JSON.parse validates the complete document first. This bounded, iterative
+// walk only locates member spans; it never decodes or reserializes foreign values.
+function valueEnd(text, from) {
+    if (text[from] === '"')
+        return stringEnd(text, from);
+    if (text[from] === '{' || text[from] === '[') {
+        let depth = 0;
+        for (let i = from; i < text.length; i++) {
+            if (text[i] === '"')
+                i = stringEnd(text, i) - 1;
+            else if (text[i] === '{' || text[i] === '[')
+                depth++;
+            else if ((text[i] === '}' || text[i] === ']') && --depth === 0)
+                return i + 1;
+        }
+        throw new Error('mcp-config-invalid');
+    }
+    let end = from;
+    while (end < text.length && !' \t\r\n,}]'.includes(text[end]))
+        end++;
+    return end;
+}
+function objectSpan(text, start) {
+    const members = [];
+    const keys = new Set();
+    let offset = whitespace(text, start + 1);
+    while (text[offset] !== '}') {
+        const endOfKey = stringEnd(text, offset);
+        const key = JSON.parse(text.slice(offset, endOfKey));
+        if (keys.has(key))
+            throw new Error('mcp-config-ambiguous');
+        keys.add(key);
+        const valueStart = whitespace(text, whitespace(text, endOfKey) + 1);
+        const end = valueEnd(text, valueStart);
+        const separator = whitespace(text, end);
+        const comma = text[separator] === ',' ? separator : undefined;
+        members.push({
+            key,
+            start: offset,
+            valueStart,
+            end,
+            ...(comma === undefined ? {} : { comma }),
+        });
+        offset = comma === undefined ? separator : whitespace(text, comma + 1);
+    }
+    return { start, members };
+}
+function document(text) {
+    const value = JSON.parse(text);
+    if (!isPlainObject(value) ||
+        (Object.hasOwn(value, 'mcpServers') && !isPlainObject(value.mcpServers)))
+        throw new Error('mcp-config-invalid');
+    const root = objectSpan(text, whitespace(text, 0));
+    const servers = root.members.find((member) => member.key === 'mcpServers');
+    const serverSpan = servers === undefined ? undefined : objectSpan(text, servers.valueStart);
+    return { config: { ...value, mcpServers: value.mcpServers ?? {} }, root, serverSpan };
+}
+export function readMcpConfig(text) {
+    return document(text).config;
+}
+function editMember(text, span, key, value) {
+    const index = span.members.findIndex((member) => member.key === key);
+    const existing = span.members[index];
+    if (existing !== undefined) {
+        if (value !== undefined)
+            return text.slice(0, existing.valueStart) + JSON.stringify(value) + text.slice(existing.end);
+        const precedingComma = span.members[index - 1]?.comma;
+        const start = existing.comma !== undefined || precedingComma === undefined
+            ? existing.start
+            : precedingComma;
+        const end = existing.comma === undefined ? existing.end : existing.comma + 1;
+        return text.slice(0, start) + text.slice(end);
+    }
+    if (value === undefined)
+        return text;
+    // Prepend only owned text. In particular, retain the original leading
+    // whitespace before foreign members so removing this entry restores it.
+    const inserted = `${JSON.stringify(key)}:${JSON.stringify(value)}${span.members.length ? ',' : ''}`;
+    return text.slice(0, span.start + 1) + inserted + text.slice(span.start + 1);
+}
+export function editMcpServers(text, changes) {
+    for (const [key, value] of changes) {
+        const parsed = document(text);
+        text =
+            parsed.serverSpan === undefined
+                ? value === undefined
+                    ? text
+                    : editMember(text, parsed.root, 'mcpServers', { [key]: value })
+                : editMember(text, parsed.serverSpan, key, value);
+    }
+    return text;
+}

package/packages/cli/dist/integrations/memory-doctor.js

@@ -0,0 +1,124 @@
+import path from 'node:path';
+import { readBounded } from './verify.js';
+import { runProviderProcess } from './spawn.js';
+import { handshake, parseSubsystemsManifest, subsystemsManifestPath, } from '../lib/subsystems.js';
+const MAX_MACHINE_MANIFEST_BYTES = 64 * 1024;
+const result = (status, reason, runtime, contract) => ({ status, reason, runtime, contract });
+function manifestLocation(env) {
+    try {
+        const file = subsystemsManifestPath(env, process.platform);
+        const root = process.platform === 'win32' ? env.APPDATA : env.HOME;
+        if (root === undefined || root === '')
+            return null;
+        const rel = path.relative(root, file).split(path.sep).join('/');
+        if (rel === '' || rel.startsWith('../') || path.isAbsolute(rel))
+            return null;
+        return { root, rel };
+    }
+    catch {
+        return null;
+    }
+}
+function bridge(runner, repoDir) {
+    return async (file, args, { timeoutMs }) => {
+        const process = await runner({ executable: file, args, repoDir, timeoutMs });
+        if (process.status === 'ok' || (process.status === 'failed' && process.exitCode !== null))
+            return { code: process.exitCode ?? 1, stdout: process.stdout, stderr: process.stderr };
+        if (process.status === 'failed')
+            return {
+                code: 1,
+                stdout: '',
+                stderr: '',
+                spawnError: Object.assign(new Error('provider unavailable'), { code: 'ENOENT' }),
+            };
+        return { code: 1, stdout: '', stderr: '' };
+    };
+}
+/**
+ * The Memory boundary owns its doctor output. Rig accepts only the published
+ * v1 summary shape and never forwards its detail or fix text into Rig output.
+ */
+function parseDoctorSummary(stdout) {
+    let value;
+    try {
+        value = JSON.parse(stdout);
+    }
+    catch {
+        return null;
+    }
+    if (typeof value !== 'object' || value === null || Array.isArray(value))
+        return null;
+    const report = value;
+    if (report.schemaVersion !== 1 || !isDoctorStatus(report.status) || !Array.isArray(report.checks))
+        return null;
+    let expected = 'ok';
+    for (const check of report.checks) {
+        if (typeof check !== 'object' || check === null || Array.isArray(check))
+            return null;
+        const record = check;
+        if (typeof record.id !== 'string' ||
+            record.id === '' ||
+            !isDoctorStatus(record.status) ||
+            typeof record.detail !== 'string' ||
+            typeof record.fix !== 'string')
+            return null;
+        if (record.status === 'fail')
+            expected = 'fail';
+        else if (record.status === 'warn' && expected === 'ok')
+            expected = 'warn';
+    }
+    return report.status === expected ? report.status : null;
+}
+function isDoctorStatus(value) {
+    return value === 'ok' || value === 'warn' || value === 'fail';
+}
+/** Inspect only the registered machine-local Memory boundary; never provider data. */
+export async function inspectMemory(options) {
+    const location = manifestLocation(options.env);
+    if (location === null)
+        return result('warn', 'machine-config-root-unavailable', 'unverified', 'unverified');
+    const source = await readBounded(location.root, location.rel, MAX_MACHINE_MANIFEST_BYTES);
+    if (source.status === 'absent')
+        return result('pass', 'not-configured', 'unverified', 'unverified');
+    if (source.status !== 'ok')
+        return result('fail', 'manifest-invalid', 'unverified', 'unverified');
+    let manifest;
+    try {
+        manifest = parseSubsystemsManifest(new TextDecoder('utf-8', { fatal: true, ignoreBOM: true }).decode(source.bytes));
+    }
+    catch {
+        manifest = null;
+    }
+    if (manifest === null)
+        return result('fail', 'manifest-invalid', 'unverified', 'unverified');
+    const runner = options.runner ?? runProviderProcess;
+    const checked = await handshake(manifest.entries.memory, bridge(runner, options.repoDir));
+    if (checked.status === 'foreign-major')
+        return result('fail', 'foreign-contract', 'unverified', 'foreign');
+    if (checked.status === 'unsupported')
+        return result('warn', 'executable-missing', 'unverified', 'unverified');
+    if (checked.status !== 'ok')
+        return result('fail', 'handshake-failed', 'unverified', 'unverified');
+    const doctor = await runner({
+        executable: manifest.entries.memory.invocation[0],
+        args: [manifest.entries.memory.invocation[1], 'doctor', '--json'],
+        repoDir: options.repoDir,
+    });
+    if (doctor.status === 'ok') {
+        const summary = parseDoctorSummary(doctor.stdout);
+        if (summary === null)
+            return result('fail', 'doctor-invalid', 'unverified', 'compatible');
+        if (summary === 'ok')
+            return result('pass', 'doctor-ok', 'verified', 'compatible');
+        if (summary === 'warn')
+            return result('warn', 'doctor-warn', 'verified', 'compatible');
+        return result('fail', 'doctor-failed', 'verified', 'compatible');
+    }
+    if (doctor.status === 'timeout')
+        return result('fail', 'doctor-timeout', 'unverified', 'compatible');
+    if (doctor.status === 'cleanup-unconfirmed')
+        return result('fail', 'doctor-cleanup-unconfirmed', 'unverified', 'compatible');
+    if (doctor.status === 'failed' && doctor.exitCode === null)
+        return result('warn', 'executable-missing', 'unverified', 'compatible');
+    return result('fail', 'doctor-failed', 'verified', 'compatible');
+}

package/packages/cli/dist/integrations/registry.js

@@ -0,0 +1,22 @@
+export const REGISTRY = Object.freeze([
+    Object.freeze({
+        id: 'basic-memory',
+        displayName: 'Basic Memory (wiring-only preview)',
+        routes: Object.freeze({ 'claude-code': 'automatic', codex: 'automatic' }),
+    }),
+    Object.freeze({
+        id: 'spec-kit',
+        displayName: 'Spec Kit (upstream-managed)',
+        routes: Object.freeze({ 'claude-code': 'automatic', codex: 'automatic' }),
+    }),
+    Object.freeze({
+        id: 'figma-mcp',
+        displayName: 'Figma MCP',
+        routes: Object.freeze({ 'claude-code': 'automatic', codex: 'automatic' }),
+    }),
+    Object.freeze({
+        id: 'atlassian-mcp',
+        displayName: 'Atlassian MCP',
+        routes: Object.freeze({ 'claude-code': 'automatic', codex: 'automatic' }),
+    }),
+]);